Open c4-bot-4 opened 3 months ago
Function settleWithBuyout() and placeBid() can be called at the same moment when block.timestamp = _auction.startTime + _timeForMainLenderToBuy.
settleWithBuyout()
placeBid()
block.timestamp = _auction.startTime + _timeForMainLenderToBuy
It could cause loss of bidding amount if the users bid and then the auction is settled with buyout.
Do not allow buyout when block.timestamp = _auction.startTime + _timeForMainLenderToBuy anymore.
_checkAuction(_nftAddress, _tokenId, _auction); uint256 timeLimit = _auction.startTime + _timeForMainLenderToBuy; - if (timeLimit < block.timestamp) { + if (timeLimit <= block.timestamp) { revert OptionToBuyExpiredError(timeLimit); } uint256 largestTrancheIdx;
alex-ppg marked the issue as satisfactory
Lines of code
Vulnerability details
Issue
Function
settleWithBuyout()
andplaceBid()
can be called at the same moment whenblock.timestamp = _auction.startTime + _timeForMainLenderToBuy
.It could cause loss of bidding amount if the users bid and then the auction is settled with buyout.
Mitigation
Do not allow buyout when
block.timestamp = _auction.startTime + _timeForMainLenderToBuy
anymore.